Skip to content

Serve feature demo videos with their real types - #8

Open
nwaezedavid wants to merge 9 commits into
affilstack-appfrom
cowork/20261023-084502-affilstack-app
Open

nwaezedavid wants to merge 9 commits into
affilstack-appfrom
cowork/20261023-084502-affilstack-app

Conversation

@nwaezedavid

Copy link
Copy Markdown
Owner

Pushed from Claude Cowork bundle affilstack-app.bundle.

Commits:

  • Add the new features to the marketing site
  • List marketplace add-ons in the sitemap; document the developer subdomain and optional gateways in .env.example
  • Only send add-on buyers back to the Connect screen after paying
  • Build on PHP 8.4 and 8.5, and protect AffilStack from PHP2Shell
  • Accept host-backported PHP2Shell fixes by PHP build date
  • Record the Hostinger deploy target
  • Never serve release packages, backups or logs from the public folder
  • Record the release-folder layout used on Hostinger
  • Serve feature demo videos with their real types

Feature pages, homepage cards, help answers, menu links and pricing
allowances for WordPress publishing, affiliate network connections,
AffilStack in your language and the add-on marketplace, with real
screenshots. A migration ships them to existing sites without touching
admin edits. Plans now include WordPress sites and network connections,
demo data covers the new features, and dependencies get security patches.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
…main and optional gateways in .env.example

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
- composer.json requires PHP ^8.4 (the locked Symfony 8 packages already
  needed it, which is why the PHP 8.3 build failed); CI tests PHP 8.4 and
  8.5, builds the front end first, and runs on affilstack-app pushes.
  Dependabot now also proposes Composer and npm security updates.
- Tom's daily scan checks the PHP the website and the cron run on against
  the PHP2Shell fixes (8.4.27 / 8.5.12) and php.net's newest security
  release, plus risky php.ini settings; new critical/high findings email
  the admins, cleared ones close themselves, and the admin panel shows a
  red bar while the website's PHP is unpatched. security:check-php fails a
  deploy on an unpatched PHP.
- Web-shell defences: uploads carrying PHP (names, double extensions,
  .htaccess, code hidden in images) are refused on every form and API
  route; only index.php may run as PHP; requests over 40 MB stop at the
  web server; public/.user.ini turns off session upload progress and caps
  request size; Tom looks for PHP files in public and upload folders.
- Manual GitHub sync runs in the queue, so the website no longer needs
  proc_open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Hostinger backports security fixes into PHP 8.4.26 / 8.5.11 without
changing the version number. The PHP check now reads the binary's build
date: a build dated on or after the fix's release is reported as a low
note to confirm with the host instead of critical, and php.net's newer
releases are judged the same way. Build dates are shown by
security:check-php and recorded for the website's PHP.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015ZBiaiMwi6BCi8vmwJFScW
@nwaezedavid
nwaezedavid enabled auto-merge October 23, 2026 07:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants